On lawful disclosure of personal user data: What should app developers do?

2014 IEEE 7th International Workshop on Requirements Engineering and Law, RELAW 2014 - Proceedings

Volumn , Issue , 2014, Pages 25-34

  Van Der Sype, Yung Shin ^a   Maalej, Walid ^b  

^a UNIVERSITY OF LEUVEN   (Belgium)

^b UNIVERSITY OF HAMBURG   (Germany)

Author keywords

Anonymisation; Big Data; EU Data Protection Legislation; Legal Requirements; Mobile App Development; Privacy by Design

Indexed keywords

BIG DATA; MOBILE DEVICES;

ANONYMISATION; DATA PROTECTION; LEGAL COMPLIANCE; LEGAL REQUIREMENTS; MOBILE APP; PRIVACY PRACTICES; PUBLIC INTEREST; THIRD PARTIES;

DATA PRIVACY;

EID: 84908626400     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/RELAW.2014.6893479     Document Type: Conference Paper

References (63)

1. O. Tene, J. Polonetsky, "Privacy in the Age of Big Data: a Time for Big Decisions," Stanford Law Review, vol. 64, pp. 63-69, 2012.
2. P. Olson, "Meet The Company That Tracks More Phones Than Google Or Facebook," 30 10 2013. [Online]. Available: http://www.forbes.com/sites/parmyolson/2013/10/30/meet-thecompany-that-tracks-more-phones-than-google-or-facebook/.[Accessed 1 6 2014].
3. Article 29 Working Party, "Opinion 02/2013 on apps on smart devices," 2013.
4. EU Parliament and EU Council, Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OC L 281/31, http://eurlex. europa.eu/LexUriServ/LexUriServ.douri=CELEX:31995L0 046:en:pdf, 1995.
5. S. Sheth, G. Kaiser, and W. Maalej, "Us and them-A Study of Privacy Requirements Across North America, Asia, and Europe," Columbia University Computer Science Technical Reports, New York, 2013.
6. A. Cavoukian (Information and Privacy Commissioner of Ontario), Privacy Engineering: Proactively Embedding Privacy, by Design, Canada, 2014.
7. P. Ohm, "Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization," UCLA Law Review, vol. 57, pp. 1701-1777, 2010.
8. Article 29 Working Party, "Opinion 05/2014 on Anonymisation Techniques, WP216," 2014.
9. Article 29 Working Party, "Opinion 03/2013 on purpose limitation, WP203," 2013.
10. J. Kokott and C. Sobotta, "The Distinction between Privacy and Data Protection in the Jurisprudence of the CJEU and the ECtHR," International Data Privacy Law, vol. 3, no. 4, 2013.
11. A. Cavoukian (Information and Privacy Commissioner of Ontario), Privacy and Security by Design: a Convergence of Paradigms, Canada, 2013.
12. Y. Altshuler, N. Aharony, A. Pentland, et al., "Stealing Reality: when Criminals become Data Scientists (or Vice Versa)," IEEE Intelligent Systems Magazine, vol. 26, no. 6, pp. 22-30, 2011.
13. ENISA, "Smartphone Secure Development Guidelines," file:///C:/Users/u0085676/Downloads/Secure-Dev-Guidelines.p df, 2011.
14. N. Wang, H. Xu, P. Wisniewski, and J. Grossklags, Designing the Default Privacy Settings for Facebook Applications, Baltimore, US, 2014.
15. E. Yildirim, Mobile Privacy: Is There An App For That?, Amsterdam, 2012.
16. A. Stopczynski, R. Pietri, A. Pentland, et al., "Privacy in Sensor-Driven Human Data Collection: A Guide for Practicioners," http://arxiv.org/pdf/1403.5299v1.pdf, 2014.
17. EU Parliament and EU Council, Directive 2006/24/EC on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC, 2006.
18. European Court of Justice, Digital Rights Ireland, C-293/12 and C-594/12, 2014.
19. D. Tokmetzis, "Dit gebeurt er allemaal onder de motorkap van je smartphone," 21 5 2014. [Online]. Available: https://decorrespondent.nl/1034/dit-gebeurt-er-allemaal-onderde-motorkap-van-je-smartphone/50352698-785491ea. [Accessed 23 5 2014].
20. Future of Privacy Organisation, "Mobile Apps Study," http://www.futureofprivacy.org/mobile-apps-study/, 2012.
21. S. Thurm, Y.I. Kane, "Your Apps Are Watching You," 17 December 2010. [Online]. Available: http://online.wsj.com/news/articles/SB100014240527487046940 04576020083703574602mg=reno64-wsjurl=http%3A%2F%2Fonline.wsj.com%2Farticle%2FSB10 001424052748704694004576020083703574602.html. [Accessed 25 5 2014].
22. D. Solove, "Privacy Self-Management and the Consent Dilemma," Harvard Law Review, vol. 126, pp. 1879-2139, 2013.
23. S. Lederer, J.I. Hong, A.K. Dey, and J.A. Landay, "Personal Privacy through Understanding and Action: Five Pitfalls for Designers," Personal and Ubiquitous Computing, vol. 8, no. 6, pp. 440-454, 2004.
24. Article 29 Working Party, "Opinion 15/2011 on Consent, WP187," 2011.
25. EU Parliament and EU Council, Proposal for a Regulation on the protection of individuals with regard to the processing of personal data and on the free movement of such data COM(2012) 11 final, 2012/0011 (COD), http://ec.europa.eu/justice/dataprotection/ document/review2012/com-2012-11-en.pdf, 2012.
26. EU Parliament, Draft European Parliament Legislative Resolution on the Proposal for a Regulation of the European Parliament and of the Council on the Protection of Individuals with regard to the processing of Personal Data and on the Free Movement of Such Data, Brussels, 2014.
27. EU Parliament and EU Council, Proposal for a Directive on the protection of individuals with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of [...], http://eurlex. europa.eu/LexUriServ/LexUriServ.douri=COM:2012:0010: FIN:EN:PDF, 2012.
28. P. Hustinx, "Opinion on the Data Protection Reform Package," Brussels, 2012.
29. M. F. Dennedy, J. Fox, and T. R. Finneran, The Privacy Engineer's Manifesto, Apress, 2014.
30. S. Gürses, C. Troncoso and C. Diaz, "Engineering Privacy by Design," in Conference on Computers, Privacy and Data Protection, Belgium, 2011.
31. D. Solove, "A Taxonomy of Privacy," University of Pennsylvania Law Review, vol. 154, 2005.
32. S. Spiekermann, and L.F. Cranor, "Engineering Privacy," IEEE Transactions on Software Engineering, vol. 35, no. 1, 2009.
33. M. Madejski, M. Johson, and S.M. Bellovin, "A Study of Privacy Settings errors in an Online Social Network," in IEEE Pervasice Computing and Communication, 2012.
34. Y. Liu, K.P. Gummadi, B. Krishnamurthy, and A. Mislove, "Analyzing Facebook Privacy Settings: User Expectations vs. Reality," in SIGCOMM, 2011.
35. F. Stutzman, R. Gross, and A. Acquisti, "Silent Listeners: the Evolution of Privacy and Disclosure on Facebook," Journal of Privacy and Confidentiality, vol. 4, no. 2, 2013.
36. L. Fang, and K. LeFevre, "Privacy Wizards for Social Networking Sites," in Internaitonal Conference on World Wide Web, New York, 2010.
37. T. Paul, M. Stopczynski, D. Puscher, M. Volkamer, and T. Strufe, "C4ps: Colors for Privacy Settings," in International Conference on World Wide Web, New York, 2012.
38. A.C. Squicciarini, M. Shehab, and F. Paci, "Collective Privacy Management in Social Networks," in International Conference on World Wide Web, New York, 2009.
39. V. Toubiana, V. Verdot, B. Christophe, and M. Boussard, "Photo-Tape: User Privacy Preferences in Photo Tagging," in International Conference on World Wide Web, New York, 2012.
40. A. Acquisti, L. John, and G. Loewenstein, "What is Privacy Worth," in Workshop on Information Systems and Economics, 2009.
41. V.S. Verykios, E. Bertino, I.N. Fovino, et al., "State-of-the-Art in Privacy Preserving Data Mining," in SIGMOD, 2004.
42. H. Polat and W. Du, "Privacy-Preserving Collaborative Filtering Using Randomized Pertubation Techniques," in International Conference on Data Mining, 2003.
43. N Lathia, S. Hailes, and L. Capra, "Private Distributed Collaborative Filtering Using Estimated Concordance Measures," in ACM Conference on Recommender Systems, New York, 2007.
44. D. Argawal and C.C. Aggarwal, "On the Design and Quantification of Privacy Preserving Data Mining Algorithms," in Symposium on Principles of Database Systems, New York, 2001.
45. S. Bhagat, G. Cormode, B. Krishnamurthy, and D. Srivastava, "Privacy in Dynamic Social Networks," in International Conference on World Wide Web, 2010, 2010.
46. Y. Zhu, L. Xiong, and C. Verdery, "Anonymizing User Profiles for Personalized Web Search," in International Conference on World Wide Web, New York, 2010.
47. A. Narayanan and V. Schmatikov, "How to Break Anonymity of the Netflix Prize Dataset," in CORR, 2006.
48. L. Backstrom, C. Dwork, and J. Kleinberg, "Wherefore art thou r3579x: anonymized social networks, hidden patterns, and structural steganography," in International Conference on World Wide Web, New York, 2007.
49. G. Wondraeck, T. Holz, E. Kirda and C. Kruegel, "A Practical Attack to De-Anonymize Social Network Users," in IEEE Symposium on Security and Privacy, 2010.
50. J. Clause and A. Orso, "Camouflage; Automated Anonymization of Field Data," in International Conference on Software Engineering, New York, 2011.
51. M. Castro, M. Costa, and J.-P. Martin, "Better bug reporting with better privacy," in Internation conference on architectual support for programming languages and operating systems, New York, 2008.
52. L. Sweeney, "K-Anonymity: a Model for Protecting Privacy," International Journal on Uncertainty, vol. 10, no. 5, pp. 557-570, 2002.
53. K. Taneja, M. Grechanik, R. Ghani, and T. Xie, "Testing Software in Age of Data Privacy: a Balancing Act," in SIGSOFT/FSE, New York, 2011.
54. T.D. Breaux, and A.I. Anton, "Analyzing regulatory rules for privacy and security requirements," in IEEE Transactions on Software Engineering, 2008.
55. T.D. Breaux, and A. Rao, "Formal analysis of privacy requirements specifications for multi-tier applications," in IEEE International Requirements Engineering Conference, 2013.
56. C. Mancini, Y. Roggers, K. Thomas, et al., "In the Best Families: Tracking and Relationships," in CHI, 2011.
57. T.T. Tun, A.K. Bandara, B.A. Price, et al., "Privacy arguments: analysing selective disclosure requirements for mobile applications," in IEEE Computer Society, 2012.
58. I. Omoronyia, L. Cavallaro, M. Salehie, et al., "Engineering Adaptive Privacy: on the role of privacy awareness requirements," in ACM ICSE, 2013.
59. M. Robillard, W. Maalej, R.J. Walker, and T. Zimmerman (eds.), Recommendation Systems in Software Engineering, Springer, 2014.
60. R. van der Meulen, "Gartner Says by 2017, Mobile Users Will Provide Personalized Data Streams to More Than 100 Apps and Services Every Day," 22 1 2014. [Online]. Available: http://www.gartner.com/newsroom/id/2654115. [Accessed 23 5 2014].
61. European Data Protection Supervisor, "Privacy and Competitiveness in the Age of Big Data," 2014.
62. EU Parliament and EU Council, Directive 2002/58/EC as revised by 2009/136/EC, http://eurlex. europa.eu/LexUriServ/LexUriServ.douri=OJ:L:2009:337:0 011:0036:en:PDF, 2009.
63. F. Brunton, H. Nissenbaum, "Political and Ethical Perspectives on Data Obfuscation," in Privacy, Due Process and the Computational Turn: the Philosophy of Law meets the Philosophy of Technology, Routledge, 2013, pp. 171-195.